Books and records: six years, three years, two accessible

How long, and how close to hand

Firms must make and keep records so that regulators can reconstruct what happened long after the event. FINRA Rule 4511 sets a default: any record for which no other period is specified must be preserved for at least six years. That default catches the records people forget about, which is exactly why it exists, and it applies to the general books and records of the business.

A shorter period applies to a defined group of transaction records. Order tickets, customer confirmations and similar trade documentation must be preserved for at least three years. These are the records of individual transactions rather than the ongoing books of the firm, and the shorter period reflects how quickly a trading question is normally raised.

Some records carry a period of their own, and a named period comes before the default. Account cards and records about opening and maintaining a customer account are kept for at least six years after the account closes, and a firm keeps its file of written customer complaints for at least four years. The six-year default is for records no rule addresses.

For the six-year records and the three-year records that SEC Rule 17a-4 lists, the first two years must be kept easily accessible. That is a separate requirement about where the record is, not about how long it is held: a firm may not answer a request by saying the record exists in deep storage and will take weeks to produce. Two years in an accessible place, then the balance of the period wherever the firm keeps its archive.

A last distinction the exam tests is what the customer receives. A confirmation reports one transaction and must be sent at or before completion of that transaction. An account statement reports a period, showing positions and activity, and is sent periodically. Both are records the firm must keep, and only one of them arrives after every trade.

A municipal confirmation also has to identify the security traded. For a municipal securities trade, MSRB Rule G-15 sets out that securities identification, which includes the issuer’s name and the CUSIP number, if one is assigned. A CUSIP number is a nine-character code that identifies a security, and it helps with clearance and settlement. In the municipal market each maturity of an issue gets its own number, and the underwriter of a new issue applies for them. The number names the security; it does not approve or rate it.

Holding a customer’s mail has its own rule and its own clock. A firm may hold mail only if it has written instructions from the customer stating the period, has told the customer about other ways to get account information and obtained confirmation of that, and verifies at reasonable intervals that the instruction still stands. Convenience will carry it for up to three consecutive months and no further: beyond three months the instruction must give an acceptable reason, such as a safety or security concern. Throughout, the firm must still communicate important account information in a timely way and take steps to ensure the mail is not tampered with, held without consent, or used by an associated person in a way that would breach the rules.

Keeping the records is one duty; keeping the customer’s property separate is another, and two rules do that work. The customer protection rule requires a broker or dealer promptly to obtain, and thereafter maintain, physical possession or control of all fully-paid securities and excess margin securities carried for the account of customers — so a customer’s paid-for shares are not available to the firm’s own business. The same rule requires a Special Reserve Bank Account for the Exclusive Benefit of Customers, held at a bank, separate from every other account of the firm, into which it deposits cash or qualified securities in an amount computed by a prescribed formula.

The net capital rule is often confused with that and asks an entirely different question. It says nothing about customers: every broker or dealer must at all times have and maintain net capital no less than the highest minimum requirement applicable to it. One rule keeps the customer’s property out of the firm’s business; the other keeps the firm itself solvent. A firm can satisfy the second while breaching the first, which is exactly why both exist.

Firms must also plan for disruption. FINRA Rule 4370 requires every member to create and maintain a written business continuity plan with procedures for an emergency or significant business disruption, reasonably designed to let the firm keep meeting its obligations to customers. The plan must cover, at a minimum, matters such as data back-up and recovery and all mission-critical systems. It must be updated after any material change to the firm’s operations, structure, business or location, reviewed every year, and made available promptly to FINRA on request. The firm must also give FINRA emergency contact information.

Exam terms

Books and records

The documents a firm must make and preserve about its business.

Six-year default

The retention period for any record with no other period specified.

Three-year records

Order tickets, confirmations and similar transaction documentation.

Easily accessible

For the six-year and three-year records SEC Rule 17a-4 lists, the first two years must be readily retrievable, wherever the rest is stored.

Confirmation

A record of one transaction, sent at or before completion of it.

Account statement

A periodic report of positions and activity over a period.

CUSIP number

A nine-character code that identifies a security, such as one maturity of a bond issue.

How the record has to be kept, not just how long

A retention period is only half the requirement. Records preserved electronically must either be kept exclusively in a non-rewriteable, non-erasable format, or be maintained with a complete time-stamped audit trail recording every modification and deletion, when each happened, and who made it.

That is why quietly editing an order record after a complaint is not a small administrative sin: the rule is built so that the edit itself leaves a mark, and a firm that has arranged its systems properly cannot lose the original version.

Worked example

A regulator asks a firm for two documents relating to a trade made 20 months ago and a third relating to a general business record from four years ago.

1. The order ticket and the confirmation both fall in the three-year category, and 20 months is well inside that period, so both must still exist.
2. They must also be produced quickly, because 20 months is inside the first two years and everything in that window has to be easily accessible.
3. The general business record has no other period specified, so it falls to the six-year default and must still be preserved at four years old.
4. That record is outside the first two years, so it may sit in archive storage, but the firm must still be able to produce it when asked.
5. Answering three years for the general record, or claiming the four-year-old document could be discarded, would each be a records violation rather than a matter of the firm’s own filing policy.

Check yourself

Try a question, then read the explanation to review the rule.

Same rule, new context

Related practice

• Records retention and privacyPractice this
• Security identifiers on confirmationsPractice this